Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
23s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/01/2025, 08:05
Static task
static1
Behavioral task
behavioral1
Sample
3d213353948aba4d80c28823d8661951.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3d213353948aba4d80c28823d8661951.exe
Resource
win10v2004-20241007-en
General
-
Target
3d213353948aba4d80c28823d8661951.exe
-
Size
1.8MB
-
MD5
3d213353948aba4d80c28823d8661951
-
SHA1
8c7dadac2ee5f348a8940ab47187b39fd025bead
-
SHA256
877671c4a555e37e34c6b9ecab2cc958b28cc9617c6f53e3841a6386de180e19
-
SHA512
36ba2c76563094e5c8248a05c088ad9c496573ccb6a9799759c38ef77f89e61b9832c617abc7322646c7c029ec8e573f82a4a1cc25b656bee5af82a188cab6c1
-
SSDEEP
24576:/r34Nhem94rOh31QzGpKHaHYSvvv22db+PowhGhomMJV4ynedX4QD/d5lBxdU7it:/I6g1AqY2v22pVfSJKyiXRd5lKu
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3016 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2736 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2552 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2248 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 328 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1032 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2812 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2500 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2180 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1252 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2956 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3056 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2300 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2940 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2396 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2944 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1812 2756 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1796 2756 schtasks.exe 29 -
Executes dropped EXE 1 IoCs
pid Process 572 csrss.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\DVD Maker\es-ES\lsass.exe 3d213353948aba4d80c28823d8661951.exe File created C:\Program Files\DVD Maker\es-ES\6203df4a6bafc7 3d213353948aba4d80c28823d8661951.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\PCHEALTH\csrss.exe 3d213353948aba4d80c28823d8661951.exe File created C:\Windows\PCHEALTH\886983d96e3d3e 3d213353948aba4d80c28823d8661951.exe File created C:\Windows\diagnostics\scheduled\Maintenance\de-DE\spoolsv.exe 3d213353948aba4d80c28823d8661951.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2736 schtasks.exe 2500 schtasks.exe 3056 schtasks.exe 2300 schtasks.exe 2552 schtasks.exe 328 schtasks.exe 2812 schtasks.exe 2956 schtasks.exe 1812 schtasks.exe 3016 schtasks.exe 1032 schtasks.exe 2180 schtasks.exe 1252 schtasks.exe 2396 schtasks.exe 2944 schtasks.exe 2248 schtasks.exe 2940 schtasks.exe 1796 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe 2808 3d213353948aba4d80c28823d8661951.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2808 3d213353948aba4d80c28823d8661951.exe Token: SeDebugPrivilege 572 csrss.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2808 wrote to memory of 840 2808 3d213353948aba4d80c28823d8661951.exe 48 PID 2808 wrote to memory of 840 2808 3d213353948aba4d80c28823d8661951.exe 48 PID 2808 wrote to memory of 840 2808 3d213353948aba4d80c28823d8661951.exe 48 PID 840 wrote to memory of 2412 840 cmd.exe 50 PID 840 wrote to memory of 2412 840 cmd.exe 50 PID 840 wrote to memory of 2412 840 cmd.exe 50 PID 840 wrote to memory of 2108 840 cmd.exe 51 PID 840 wrote to memory of 2108 840 cmd.exe 51 PID 840 wrote to memory of 2108 840 cmd.exe 51 PID 840 wrote to memory of 572 840 cmd.exe 52 PID 840 wrote to memory of 572 840 cmd.exe 52 PID 840 wrote to memory of 572 840 cmd.exe 52 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe"C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WjSZo78gzm.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:2412
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:2108
-
-
C:\Windows\PCHEALTH\csrss.exe"C:\Windows\PCHEALTH\csrss.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:572
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\DVD Maker\es-ES\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\es-ES\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\DVD Maker\es-ES\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\PCHEALTH\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\PCHEALTH\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1252
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\Default\SendTo\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3d213353948aba4d80c28823d86619513" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3d213353948aba4d80c28823d8661951" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3d213353948aba4d80c28823d86619513" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD53d213353948aba4d80c28823d8661951
SHA18c7dadac2ee5f348a8940ab47187b39fd025bead
SHA256877671c4a555e37e34c6b9ecab2cc958b28cc9617c6f53e3841a6386de180e19
SHA51236ba2c76563094e5c8248a05c088ad9c496573ccb6a9799759c38ef77f89e61b9832c617abc7322646c7c029ec8e573f82a4a1cc25b656bee5af82a188cab6c1
-
Filesize
205B
MD501fd79b7c35559c932b665886a3699bc
SHA161c92278278337fe47702ff92e46972db83eba01
SHA25697d1a41765f709149921a0207f763c27d882287334fd1c0774aff8e10cc45dfc
SHA512102068fc5463db991e340ed3c423bf9a44f2d0837bb8a98081d70f6513fe92208535f0ea17085bef5e3f5b784d95303d1062c72d7589e58a77b8dd528608a38d